CVE-2023-38520
WordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter Tampering
Severity Score
6.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
External Control of Assumed-Immutable Web Parameter vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Functionality Misuse.This issue affects Pinpoint Booking System: from n/a through 2.9.9.3.4.
El control externo de la vulnerabilidad de parámetros web supuestamente inmutables en PINPOINT.WORLD Pinpoint Booking System permite el uso indebido de la funcionalidad. Este problema afecta a Pinpoint Booking System: desde n/a hasta 2.9.9.3.4.
The Pinpoint Booking System plugin for WordPress is vulnerable to content spoofing in versions up to, and including, 2.9.9.3.4. This makes it possible for unauthenticated attackers to inject content that may alter the content and display of select pages.
*Credits:
yuyudhn (Patchstack Alliance)
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-07-18 CVE Reserved
- 2023-07-20 CVE Published
- 2024-06-04 EPSS Updated
- 2024-08-14 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-451: User Interface (UI) Misrepresentation of Critical Information
- CWE-472: External Control of Assumed-Immutable Web Parameter
CAPEC
- CAPEC-212: Functionality Misuse
References (1)
| URL | Tag | Source |
|---|---|---|
| https://patchstack.com/database/vulnerability/booking-system/wordpress-pinpoint-booking-system-plugin-2-9-9-3-4-parameter-tampering?_s_id=cve | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Booking System Search vendor "Booking System" | Booking System Search vendor "Booking System" for product "Booking System" | >= 0.0.0.0.0 <= 2.9.9.3.4 Search vendor "Booking System" for product "Booking System" and version " >= 0.0.0.0.0 <= 2.9.9.3.4" | en |
Affected
| ||||||